731028dd0604c17215fce1772e6379d813f232812d047a300924763cfe9c0600

Analysis

max time kernel
131s
max time network
179s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12-02-2024 02:08

Target

95f698826f117d286a9a0f9cdaebcfc1.exe
Size

54KB
MD5

95f698826f117d286a9a0f9cdaebcfc1
SHA1

8cb2d99086b3b5179f089e8380b0d0ce332b43d3
SHA256

731028dd0604c17215fce1772e6379d813f232812d047a300924763cfe9c0600
SHA512

25df169b71bf468527e8344125278661b1e36789283725cfd765aaf38e8bbf81971c3bb7ce15a71c568628cf3ccfb4068f90f5071b4636428e106cdf9e379f4d
SSDEEP

768:co15N5/ija+1I2j2qLp6NqMiFsZdjkoG+DpaavlVcy5U8ad4eQCRWsS8RaguOrxr:co15MzLpvuwjavf5UpLQCRvsmVr

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4396	4120	WerFault.exe	83
788	4120	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4120 wrote to memory of 4396	4120	95f698826f117d286a9a0f9cdaebcfc1.exe	88
PID 4120 wrote to memory of 4396	4120	95f698826f117d286a9a0f9cdaebcfc1.exe	88
PID 4120 wrote to memory of 4396	4120	95f698826f117d286a9a0f9cdaebcfc1.exe	88

C:\Users\Admin\AppData\Local\Temp\95f698826f117d286a9a0f9cdaebcfc1.exe
"C:\Users\Admin\AppData\Local\Temp\95f698826f117d286a9a0f9cdaebcfc1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4120
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4120 -s 284
  2⤵
  - Program crash
  PID:4396
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4120 -s 284
  2⤵
  - Program crash
  PID:788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4120 -ip 4120
1⤵
PID:1804

memory/4120-0-0x0000000044440000-0x0000000044457000-memory.dmp

Filesize
92KB

Download
memory/4120-4-0x0000000044440000-0x0000000044457000-memory.dmp

Filesize
92KB

Download
memory/4120-5-0x0000000044440000-0x0000000044457000-memory.dmp

Filesize
92KB

Download